ShinyHunters Hack: How FBI Cyber Chief Brett Leatherman Executed the Frame-Job That Led to Tor Operator Conrad Rockenhaus’s Homicide

Update: September 29, 2026:  Dutch police have taken a 24-year-old Security Analyst into custody. They allege he aided the ShinyHunters hacking collective. The arrest failed to slow the group down: in the days that followed, remaining ShinyHunters members escalated their campaign, exfiltrating sensitive FBI records and launching extortion demands against the Russian ransomware gang Cl0p.

Dutch Police Detain ‘Reformed’ Cybercriminal in Connection with ShinyHunters Investigation

For those tracking the “cyber-threat actor” roster behind this circus, “Umbreon” isn’t a dark-web C2 botnet, it’s the online alias of 19-year-old Dutch citizen Pepijn van der Stap, whom federal authorities in the Netherlands recently grabbed in an international dragnet for alleged ties to the ShinyHunters operation. 

Given the FBI Cyber Division’s legendary track record of technical illiteracy, we fully expect SAUSA Corinne Lambert and FBI Assistant Director Brett Leatherman to try to keep the Dutch kid illegally caged pre-trial for three years on a complete fairy tale, just like they did to Tor operator, Conrad Rockenhaus, with the open-source SPICE virtual machine display driver lie. 

We can already hear the federal prosecutor standing before a tech-illiterate magistrate judge in open court: “Your Honor, the defendant ‘Umbreon’, Dark-Type Operative of ‘ShinyHunters’, deployed an automated Eeveelution payload via Pokémon GO to exfiltrate Shiny Charizards directly from enterprise FBI databases!” 

(Pictured Above: Pepijn van der Stap aka “Umbreon”)

…and right on cue, the federal PR machine deployed the oldest, dustiest tactic in cyber-prosecution history: the Ross Ulbricht / Silk Road special. 

Following Rotterdam court updates remanding 24-year-old Pepijn van der Stap (“Umbreon”) for 90 days on sudden, un-related “incitement to murder” allegations, Dutch police claim van der Stap’s laptop contained substantial information about two murders planned abroad. 

Whenever federal cyber chiefs take an embarrassing 3-Terabyte zero-day beating in broad daylight on apply.fbijobs.gov, they cannot walk into court admitting their enterprise infrastructure is held together by duct tape and prayers. Instead, they leak sensationalized “murder-for-hire” claims to poison the media pool, deny bail, and secure an indefinite pre-trial remand while they scramble to assess the damage.

It is the exact same administrative playbook SAUSA Corinne Lambert and Assistant Director Brett Leatherman ran in Plano, Texas: when you lack actual technical proof, fabricate headline-grabbing “dangerousness” claims to justify illegal detention.

In 2020, they stood in open court and swore an open-source SPICE virtual machine display driver was a “Linux dark-web hacker OS” to cage 100% disabled combat veteran, Conrad Rockenhaus, pre-trial for three years. 

Today, whether they are tacking un-tested foreign hitman accusations onto a Dutch kid or lying about display drivers to a Texas magistrate, the underlying reality remains unchanged: FBI Assistant Director, Brett Leatherman’s Cyber Division failed to patch an Oracle PeopleSoft zero-day, lost 3TB of internal FBI job applicant data, and is once again relying on media hysteria to cover up a total operational disaster.

ShinyHunters, the group behind the massive FBI hack, post a new statement to their website. pic.twitter.com/JolTGhGgXi

— Joseph Cox (@josephfcox) September 29, 2026

September 23, 2026: On September 22, 2026, international cyber-extortion group ShinyHunters executed a massive cyberattack on the FBI, taking down the Special Agent Applicant Portal (apply.fbijobs.gov) and defacing the site after exploiting an unpatched Oracle PeopleSoft zero-day vulnerability.

The breach resulted in the exfiltration of approximately 3 Terabytes of sensitive personnel, HR, Criminal Justice (CJ), and Medlink records covering active agents and job applicants. Notably, ShinyHunters posted a public statement on their pay-or-leak portal addressed explicitly by name and title to Assistant Director Brett Leatherman of the FBI Cyber Division, demanding that the Bureau retract its Q2 2026 FLASH report.

FBI Special Agent Brett Leatherman, THE EXACT SAME agent who sat by while prosecutors framed Conrad Rockenhaus over a virtual machine display driver, is now getting lectured on “constitutional rights,” “reputation defense,” and “disinformation” by Shinyhunters😆😆😆 https://t.co/EEJE1qmrCI

— Mia🇦🇹 (@picklepickleg) September 22, 2026

While Brett Leatherman currently serves as the Assistant Director of the FBI Cyber Division in Washington, D.C., his career elevation traces directly back to 2020, when his old title was Supervisory Special Agent for the FBI in Frisco/Plano, Texas. Leatherman served as the lead case agent in the prosecution of Conrad Rockenhaus, a decorated veteran, 100% disabled Navy combat veteran, former NRO network architect, and Tor Operator.

Following years of extrajudicial retaliation stemming directly from Leatherman’s fraudulent prosecution, Conrad Rockenhaus was murdered in April 2026, a homicide forensically unmasked in the official forensic report.

The Plano Perjury and SPICE Driver Frame-Job: How FBI Agent Brett Leatherman’s Prosecutorial Pipeline Led to the Homicide of Tor Operator Conrad Rockenhaus

In the U.S. District Court in Plano, Texas, pretrial officer Tiffany Routh testified under oath that Rockenhaus had downloaded a “Linux hacker operating system called SPICE” to bypass device monitoring.

In reality, SPICE (Simple Protocol for Independent Computing Environments) is merely an open-source virtual machine remote-desktop graphics driver needed for computer science coursework. Under cross-examination, then-Supervisory Special Agent Brett Leatherman admitted under oath that the FBI possessed zero evidence of dark web activity, client software downloads, or monitoring disruption. Despite this admission under oath, Magistrate Judge Kimberly Johnson revoked bond, subjecting Rockenhaus to three years of extrajudicial pre trial detention on a display driver.

This Texas prosecution set off a catastrophic pipeline of state-created lethal harm. On September 4th, 2025, a unit of the USMS (U.S. Marshals Service) executed a violent, warrantless raid on Conrad wife’s (Adrienne Rockenhaus’s) safe house, beating Conrad Rockenhaus in the driveway and inflicting a severe Traumatic Brain Injury (TBI).

Rather than receiving emergency neurological treatment, Conrad Rockenhaus was transferred to FCI Milan, where he was subjected to solitary confinement, medical neglect, physical beatings, and chemical torture. This unbroken sequence of events culminated in a fatal April 2026 fire and the subsequent homicide of Conrad Rockenhaus.

The public callout of FBI Cyber Agent, Brett Leatherman, by ShinyHunters brings the 2020 Plano paper trail full circle, connecting the genesis of a fatal prosecution to the largest cybersecurity failure in recent Bureau history.